# AgentGuard Update: Open Core, Break-Glass Governance — and the First Real-World Finds

> Source: <https://dev.to/agentguard/agentguard-update-open-core-break-glass-governance-and-the-first-real-world-finds-fnp>
> Published: 2026-09-09 19:54:24+00:00

When I posted the launch here on dev.to, the pitch was simple: I attacked my own repo — and my own PR bot blocked the attack before merge. A lot has moved since then. Here's the honest update, including the uncomfortable parts.

AgentGuard has been two clearly separated parts since this week:

Why the split? Because a CI gate for coding agents is either a hobby or a product. I chose the latter. The community loses nothing: the engine stays MIT, the Action stays free for public repos. The line is documented in [LICENSING.md](https://github.com/agentguard-dev/agentguard/blob/main/LICENSING.md) — in plain text, not fine print.

Every honest security policy needs exceptions. The naive version is the permanent bypass: switch it off once, it stays off forever. Our answer in v0.2.2:

And here's the part that matters to me: we don't claim the expiry works — we demonstrate it publicly. A test waiver ([#13](https://github.com/agentguard-dev/agentguard/issues/13)) runs in our own repo and expires automatically on **16 Sep 2026**. The guardian run after that documents it publicly: commented, warned, closed. That's the difference between a policy on paper and one that proves itself. For your own repo: [break-glass policy](https://github.com/agentguard-dev/agentguard/blob/main/docs/BREAK-GLASS.md), [ADR-002](https://github.com/agentguard-dev/agentguard/blob/main/docs/ADR-002-break-glass-governance.md), [workflow template](https://github.com/agentguard-dev/agentguard/blob/main/workflow-templates/break-glass-guard.yml).

The full suite has grown to **85 tests**: 59 in the public engine repo, 26 in the Pro repo. Still deterministic, still no LLM in the scan path. And still dogfooding: the scan of our own repo runs in our own CI — every landing page change has to pass our own gate first. That exact setup has already blocked one of our own PRs. Working as designed; it's all in the [changelog](https://github.com/agentguard-dev/agentguard/blob/main/CHANGELOG.md).

Two active open-source repos, two invisible characters:

Invisible in every diff and every review — but a different file for the model than for the human reading it. That's the documented invisibility trick, not a theoretical scenario. Both finds are byte-verified and were responsibly disclosed to the maintainers — **with no public naming**. If the maintainers want, there will be an update here.

Prices unchanged: **Free**, **Pro $19/repo/month**, **Audit $499** (one-time), **RedTeam $499/quarter**.